fix(hotkeys): a locked vault must not hand the foreground back

Both locked-vault paths cancelled the autofill with the default refocus, which returns the foreground to the captured target - right after Delphi had raised our window. Ctrl+Shift+Q flashed for a frame then Notepad took over; Ctrl+Shift+L moved the window twice because focusApp had to take it back.

js/app.autofill.js

@@ -253,7 +253,10 @@ async function autofillHandleRequest(windowTitle, kind) {
     if (!state.cryptoKey || state.locked || !state.token) {
         // Vault is locked — bring the app to the front so the user can
         // unlock immediately, rather than silently no-op'ing the hotkey.
-        Bridge.cancelAutofill();
+        // refocus=false: the default hands the foreground back to the target,
+        // which focusApp would then have to take away again — two window moves
+        // to end where one gets us, and the round trip is visible.
+        Bridge.cancelAutofill(false);
         Bridge.focusApp();
         setTimeout(() => {
             const pwd  = document.getElementById('loginPassword');